[PATCH 6.1.y] Bluetooth: ISO: drop unbalanced sock_put() in iso_conn_ready()

[PATCH 6.1.y] Bluetooth: ISO: drop unbalanced sock_put() in iso_conn_ready()

[Andrey Misiurov]

Commit 1702f12cf59a ("Bluetooth: ISO: fix use-after-free of listener
socket in iso_conn_ready"), the 6.1.y backport of upstream 560bef609fa5,
puts the listener when it is no longer listening. Upstream that put
balances the reference taken by iso_get_sock(). On 6.1.y
iso_get_sock_listen() takes no reference (it got one only in v6.8 with
fa224d0c094a), and no other exit of iso_conn_ready() puts the parent.

No race is needed to hit it: shutdown() of a bound socket sets
SOCK_ZAPPED and keeps BT_BOUND, so listen() still succeeds and the
listener stays BT_LISTEN with SOCK_ZAPPED. Every incoming connection
then takes the new branch, and the second one frees the listener while
it is still on iso_sk_list and attached to its file.

Drop the put.

Found while reviewing a backport of this fix; not reproduced at
runtime.

Fixes: 1702f12cf59a ("Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready")
Signed-off-by: Andrey Misiurov <amisiurov@cloudlinux.com>
---
6.1.y only: 6.6.y and later have the reference-taking lookup.

The closed-listener race that 560bef609fa5 fixes does not free the
listener on 6.1.y: iso_sock_release() calls sock_orphan() before
iso_sock_kill(), which then returns early on SOCK_DEAD, so a released
ISO socket is never freed (fixed upstream by ce57442a3792 "Bluetooth:
ISO: fix leaking sk after socket release", not in 6.1.y). If that
commit is backported, iso_get_sock_listen() needs to take a reference
as upstream does.

 net/bluetooth/iso.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -1536,7 +1536,6 @@ static void iso_conn_ready(struct iso_conn *conn)
 		if (parent->sk_state != BT_LISTEN ||
 		    sock_flag(parent, SOCK_ZAPPED)) {
 			release_sock(parent);
-			sock_put(parent);
 			return;
 		}

Re: [PATCH 6.1.y] Bluetooth: ISO: drop unbalanced sock_put() in iso_conn_ready()

[Sasha Levin]

> Commit 1702f12cf59a ("Bluetooth: ISO: fix use-after-free of listener
> socket in iso_conn_ready"), the 6.1.y backport of upstream 560bef609fa5,
> puts the listener when it is no longer listening.

Queued for 6.1, thanks.

-- 
Thanks,
Sasha